hardMultiple ChoiceObjective-mapped
SSCP Practice Question: A security analyst reviews firewall logs and sees…
A security analyst reviews firewall logs and sees multiple 'ACL drop' entries for a specific internal IP trying to connect to a database server on port 1433. The rule base has an explicit permit for this traffic. What is the most likely reason for the drops?
⚠ Common exam trap
Many exam-takers assume an explicit permit rule guarantees traffic flow, but they forget that ACLs are processed top-down and an earlier deny rule can override a later permit rule.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An earlier deny rule matches the traffic before the permit rule
The most likely reason for the ACL drops despite an explicit permit rule is that an earlier deny rule in the firewall rule base matches the traffic before the permit rule. Firewalls process ACL rules sequentially from top to bottom; the first matching rule determines the action. If a deny rule appears before the permit rule and matches the source IP, destination port, or other criteria, the traffic is dropped before reaching the permit entry.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall rule is disabled
Why it's wrong here
A disabled rule would not match; but if it's disabled, no drops would occur for that specific permit intent.
- ✗
The database server is down
Why it's wrong here
A down server would result in connection timeouts or resets, not firewall ACL drops.
- ✓
An earlier deny rule matches the traffic before the permit rule
Why this is correct
Rule ordering is critical; a preceding deny rule that matches the same traffic will cause drops even if a later permit exists.
- ✗
The internal IP is on a blacklist
Why it's wrong here
A blacklist would usually be implemented via a deny rule; if present, it would override the permit. This is plausible but less specific than a rule ordering issue.
Visual reference
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.